https://gitlab.synchro.net/main/sbbs/-/commit/837e19692961860aed5cccf9
Added Files:
exec/load/ircd/link-security.js tls.js tls.md exec/tests/ircd/link-security.js tls-network.py tls-worker.sjs tls.js
Modified Files:
exec/ircd.js ircdcfg.js exec/load/ircd/config.js core.js server.js services.js unregistered.js user.js exec/tests/ircd/state.js
Log Message:
ircd: add validated TLS server links and route security reporting

Support dedicated TLS listeners and automatic/manual outbound server links. Validate the peer hostname, certificate dates, server-authentication usage
and trust chain against an explicit PEM CA bundle before sending IRC credentials. Enforce TLS-required inbound peers before password/QWK authentication, close on validation failure without plaintext fallback,
and expose the settings in ircdcfg with configuration round-trip support.

Add optional LINKSEC observations and an unprivileged TLSROUTE command to report each server hop's encryption and certificate-checking endpoint.
Accept remote observations through configured hubs, keep legacy gaps and untrusted leaf claims unknown, and retain contradictory evidence without reporting a verified route. Tie observations to live topology edges so
splits and same-name reconnects discard old state; explicitly distinguish embedded services from network links.

Preserve existing plaintext links and legacy services without requiring
the new capability during rolling upgrades.

Validation: 127 state/config/services checks, native certificate rejection
and multi-hub TLS/reconnect scenarios, and all nine rolling-upgrade checks against each of the saved 1.3 and 2.0 IRCds.

---
■ Synchronet ■ Vertrauen ■ Home of Synchronet ■ [vert/cvs/bbs].synchro.net